code-conventionslisted

# Code conventions ## Build & gates ```bash ./mvnw clean verify # everything: Java tests (Arconia/Testcontainers PostgreSQL), # Spotless, Checkstyle, CycloneDX SBOM, UI gates, packaged jar (cd src/main/frontend && pnpm test:stories) # Storybook story tests in real chromium (axe-as-error) (cd src/main/frontend && pnpm e2e) # Playwright vs the real jar + mock OIDC IdP (compose.e2e.yaml) reqstool status local -p docs/reqstool # must end "N/N complete · PASS" (run after the two above) openspec validate --all --strict ``` - Always `clean` before trusting the reqstool gate: the annotation processor writes per-source-set files that incremental compilation truncates. - The UI is built INSIDE `./mvnw verify` (frontend-maven-plugin, pinned node/pnpm); `cd src/main/frontend && pnpm …` is only for UI development loops and e2e. - `./mvnw -q spotless:apply` before committing Java. ## Java - Java 25, Spring Boot 4. Constructor injection, no Lombok, records for DTOs. - Persistence via `JdbcClient` + Flyway (no JPA). **Single `V1__init.sql` while pre-1.0** — fold schema changes into it rather than adding a `V2__…`. No compatibility is promised between versions before 1.0.0, so there is no deployed database to upgrade, and every environment rebuilds from scratch. Two consequences: a data-repair migration has no rows to repair and is never the answer, and editing `V1` changes its checksum, so existing local data